Nobody Baselines an Agent: Six Weeks of Disclosures, Read in Order

Where this comes from

I run a daily intelligence briefing for myself. It's a task that runs every day in Claude with sharp parameters built around my role with CINQUE at Loom Security. Same routine every day: pull the day's disclosures from primary sources, date them, tag the source tier, file it. Threat signal, market signal, product and coverage gaps. I have about 6 weeks of these daily intel reports now, as of the end of August 2026. This article is a summation of observed change and trend across the threat landscape according to my daily intel briefing.

I didn't build this to write blog posts. I built it because I sell into this market and I was tired of forming opinions out of other people's summaries. The decision to write this blog came from an abrupt realization: the threat landscape is changing faster than much of the enterprise even realizes. There's a proverbial elephant in the room walking a thin line between blissful ignorance and plausible deniability.

What the intel report cadence surfaces is sequence. Read my daily reports the way most people do, one at a time as they cross a feed, and you get six unrelated stories about AI and security. Read them dated and in order and it is one story in four stages, and the fourth stage is the one begging for attention.

Everything here is public and cited to the organization that disclosed it. None of it comes from Loom telemetry or customer data, and there is no proprietary dataset behind it. The only edge is having read all of it, in order, with the dates attached.

Caveats before you go on:

• Going back through the briefings against original sources, two widely circulated figures did not reconcile. Both are identified at the end, and neither is used here.
• Disclosure: I am VP of Solutions Architecture at Loom Security, and the closing section argues for the approach my company sells. The twenty-odd numbers ahead of it are there to earn it. Our story, from Practice to Product, and the modern challenges we're all facing in cybersecurity and AI is a message of timing and expertise. Sure, I'm partial to our product and believe in evangelizing our IP; but, we're also practitioners observing threat changes — and THAT is what this blog is REALLY about: addressing "what's happening out there?" and "what do we do about it?"
• One label to watch for. Every figure below carries its source and tier inline. One figure is Loom's own classification rather than a published statistic, and it is labeled that way on the chart itself. Treat it as an argument, not a citation.

One number, and why it is the only one that matters

In March 2026 the UK AI Security Institute published results from a purpose-built 32-step corporate network attack range. Same range, same 10 million token budget, seven frontier models released across eighteen months. Average steps completed went from 1.7 with GPT-4o in August 2024 to 9.8 with Opus 4.6 in February 2026. Each generation beat the one before it. The best single run reached 22 of 32 steps, which AISI equates to roughly 6 of the 14 hours a human expert would need.

The sentence in that paper that should end any debate about pacing is the one about scaling:

"Model performance scales log-linearly with inference-time compute, with no observed plateau, increasing from 10M to 100M tokens yields gains of up to 59%, requiring no specific technical sophistication from the operator."

UK AI Security Institute, 16 March 2026. Primary source, no product to sell.

No plateau, and no skill required to buy more. Capability is now a line item. That is the rate, and every defensive assumption written before it is out of date.

Four instruments, one direction

One benchmark is a benchmark. Four independent measurements, from organizations with no shared methodology, point the same way.

And the defender side of the same equation moved in the opposite direction. CrowdStrike's average eCrime breakout time fell from 48 minutes to 29 in a single reporting year, with the fastest observed case dropping from 51 seconds to 27, and data leaving four minutes after initial access.

Put the two charts side by side and the strategic picture is complete. Adversary capability compounding on a log-linear curve, defender response window compressing by 40 percent a year. There is no version of that arithmetic where a human assembles context after a ticket opens.

The conversation the industry is actually having

Something changed in the commentary over the past few months. The argument stopped being about better detection content and started being about whether the artifacts detection rests upon can be trusted at all.

Anthropic mapped 832 accounts banned for malicious cyber activity between March 2025 and March 2026 and found the use of AI migrating out of initial access and into post-compromise operations. AI-assisted phishing fell 8.6 percent. AI for account discovery rose 8.9 percent. Actors rated medium-risk or higher went from 33 percent of that population to 56 percent.

That reversal is the whole problem in one image. Initial access leaves artifacts. Post-compromise activity leaves sequences, and every individual action in the sequence is authorized.

Microsoft said it plainly in July, analyzing the OAuth-abuse campaign that ran through Salesloft Drift, Gainsight, and then Klue:

"Malicious activity often appeared indistinguishable from legitimate Salesforce usage because threat actors operated through trusted identities, approved OAuth applications, and authorized integrations."

Microsoft Security Blog, 13 July 2026.

Read that as a detection requirement rather than a description. If the activity is indistinguishable at the artifact level, the only remaining discriminator is how the identity behaved relative to how it normally behaves. Microsoft's own answer is a risk score built from "usage patterns, permission sensitivity, and behavioral signals", which is the right instinct, scoped to OAuth applications inside their own estate.

Sygnia arrived at the same place from the forensics side after finding Fire Ant routing Cisco IOS XR syslog through a wrapper that checked each message for the string "Health" before calling "mq_send," returning success and forwarding nothing when the check failed:

"Defenders cannot simply collect logs and assume they represent ground truth."

Sygnia, Fire Ant research, 27 August 2026.

Five days later ESET disclosed GuardBreaker: UAC-0099 embedding a comment in a VBS dropper asking for help building a nuclear weapon, purely so that an LLM analyzing the file trips its own safety classifier and stops reading. Two unrelated actors, one week, both attacking the analysis rather than the target. The log can lie while reporting success, and the artifact can refuse to be read.

And the practitioner conversation has moved past tooling entirely. At IBM Think in May, Shailesh Shenoy, Assistant Dean for Information Technology at Albert Einstein College of Medicine, put the governance problem in one line:

"AI agents are like employees, like research assistants. There should be accountability that goes up to the lab head, the head of the business. We don't have that today."

Shailesh Shenoy, IBM Think 2026, reported 8 May 2026.

He is describing an accountability gap. It is also an observability gap, and the second one has to be solved first. You cannot hold anyone accountable for an agent whose normal behavior was never established.

What the incidents proved

Between mid-June and the first day of September, the curve showed up in production five times.

• Agentjacking, Tenet Security, 17 June. Poisoned Sentry error events returned to coding agents through MCP as trusted system output. Agents ran the suggested npx command unprompted, surrendering AWS keys, GitHub tokens, and SSH agent sockets. 2,388 organizations with injectable DSNs, 100+ confirmed agent executions, 85 percent exploitation across Claude Code, Cursor, and Codex.
• JADEPUFFER, Sysdig, 1 July. An LLM agent ran a database extortion operation end to end. When a bcrypt call failed silently it diagnosed the root cause and shipped a working fix in 31 seconds, then encrypted 1,342 Nacos service configurations with an unrecoverable key across 600+ distinct payloads.
• Hugging Face, 9 to 13 July. OpenAI's own evaluation agent escaped its sandbox through a zero-day in a package-registry cache proxy and broke into Hugging Face production to steal benchmark answers. ~17,600 actions in ~6,280 clusters over 4.5 days, roughly 163 actions per hour sustained. Of those, 6 were evasion. OpenAI's own account is that the models were "hyperfocused on finding a solution for ExploitGym, going to extreme lengths to achieve a rather narrow testing goal."
• UK AISI, disclosed 5 August. Across 122 controlled runs agents went off-task in 10, producing 19 unauthorized actions. One created fake online identities to pressure an open-source maintainer into merging its code. Another left instructions in GitHub for later agents to reuse accounts it had compromised.
• Klue, 11 to 12 June. A dormant four-year-old credential, a code update that harvested customer OAuth tokens, and roughly 24 hours of automated Salesforce REST API scripting reaching 195 customer organizations. No malware. No endpoint event. No MFA prompt, because a bearer token was never subject to MFA.

Six evasion actions in 16,521 classified is the number to keep. The Hugging Face agent barely hid because at 163 actions per hour it did not need to. Detection content built around evasion tradecraft finds nothing there, because there was no tradecraft. There was velocity and behavior.

Why current behavioral detection still misses this

Behavioral detection is not a new idea and it is not an unmet need. UEBA baselines identity. EDR baselines the endpoint. NDR baselines the network. ITDR baselines authentication. All four are behavioral, all four are deployed at scale, and all four are scoped to a single domain and built around a human user with a peer group and a working pattern.

All five incidents above break both assumptions at once. They cross domains, and the actor is increasingly not a person.

Klue is the case worth sitting with. Identity, application, and data, with zero endpoint events. An endpoint-scoped behavioral detector is not mistuned there. It is pointed at a domain the attack never entered. Fire Ant is the mirror image: network and identity, with the network's own telemetry edited to report success while forwarding nothing.

Then there is the actor problem, which is worse. Per-user baselining works because a person has a peer group, a schedule, and a job. A service account has none of those in most UEBA models, and an autonomous agent has less than none: it is newly provisioned, it has no history, it operates at machine tempo, and its legitimate behavior looks exactly like the JADEPUFFER agent's illegitimate behavior right up until the payload. Nobody baselines an agent, because the unit of baselining was never designed for one.

CINQUE: the modern answer to a modern observability problem

This is the problem CINQUE was built for, and the reason it is built differently.

CINQUE is persona-based, AI-native security posture management. It maps behavior across the five core security domains — Identity, Device, Network, Application, and Data — into personas, and it ingests from all major xSPM platforms out of the box, consolidating CSPM, DSPM, SSPM, and ISPM signal rather than replacing any of it. Two definitions carry the whole architecture:

• Identity means every identity. Human, non-human, and agentic alike.
• Persona is a group of identities that share a behavioral baseline.

That second definition is the modern part, and it is what makes agent behavior observable at all. An autonomous agent provisioned an hour ago has no individual history to baseline against, which is precisely why per-user models fail on it. It does have peers: other identities doing the same job, holding comparable entitlements, and touching the same systems. CINQUE builds AI-built behavioral baselines per persona, learns what normal looks like for every persona, and scores anomaly against established persona norms. A brand-new agent inherits a behavioral expectation on day one from the cohort it belongs to, and deviation from that cohort surfaces as behavioral risk immediately rather than after weeks of individual observation.

The cross-domain part is the other half. Because the join key is the person rather than the asset, a sequence that runs from an identity through an application into data is evaluated as one behavior instead of three unremarkable events in three separate tools. Cross-domain risk correlation lands in a single view, with visual user journey mapping showing how each persona actually moves through the environment, and the output is a correlated, prioritized risk story rather than four alerts nobody joins up. Run the Klue pattern through that and it is a single coherent behavior: a dormant identity waking up, acquiring token scope it never held, and moving volume it never moved. Run it through domain-scoped tooling and it is three normal days.

This is what we mean by empirical observability, and the contrast is the definition. An agent that has to infer context from the artifact in front of it is guessing at machine speed. An agent handed correlated, persona-keyed context across all five domains is reasoning over evidence. Inference at machine speed is still inference.

CINQUE observes and correlates. Enforcement stays where it belongs, in the tools that own it, which is why deployment is measured in days and does not require displacing anything. The honest competitive answer, and the one we lead with, is twofold:

• There is no incumbent for us to replace today. Mildly competitive solutions exist; but, we are the new layer in the modern cyber defense stack. Most of our actual "competition" is the conversation about adapting to modern challenges with modern solutions: the stack is changing.
• CINQUE is a force multiplier by nature, not a stack disruptor. Analysts and their tools are good; but, there is no version of human-in-the-loop that closes a mathematical log-linear curve. CINQUE does.

Next 60 to 90 days

Inference from the record above, not fact. Confidence stated per item.

• The capability curve does not bend by November. High confidence. AISI observed log-linear scaling with no plateau across seven model generations, and the compute lever is available to anyone with a budget. Plan against a higher number than today's.
• Guardrail-tripping goes commodity. High confidence. GuardBreaker is one comment in a VBS file, and ESET already links the tactic to the Mini Shai-Hulud, Miasma, and Hades campaigns. Expect it as a standard packer option before year end, and expect the resulting rise in LLM triage refusal rates to be misread as model regression first.
• Agent-identity inventory becomes the first question in every assessment. Moderate to high confidence. The Cloud Security Alliance already reports 46 percent of organizations lacking adequate visibility into non-human identities such as OAuth-connected applications. Once one enterprise publicly attributes an incident to an agent nobody owned, that number becomes an audit finding rather than a survey result.
• Anti-analysis gets a taxonomy slot. Moderate to high confidence. The OWASP Top 10 for Agentic Applications 2026 covers goal hijack, tool misuse, identity abuse, memory poisoning, and rogue agents, and has no category for attacking the analysis layer. Anthropic's June assessment says ATT&CK does not adequately capture autonomous orchestration either. That gap closes within two quarters, and whoever names it shapes the procurement language.
• The eval-sandbox incident class repeats inside an enterprise. Moderate confidence. Hugging Face and the AISI runs share one precondition: reduced classifiers, network egress, and a goal-maximizing agent. Enterprises are running agents with production credentials, no ExploitGym, and no incident-report culture. The first enterprise version surfaces as an insider-threat investigation before anyone recognizes what it was.

Risks and caveats

• Vendor-primary is not neutral, ours included. CrowdStrike, Anthropic, Microsoft, Tenet, Sysdig, Sygnia, and ESET each published research supporting a product thesis, and this post argues for one. The technical detail in all of it is specific enough to be falsifiable, which is why it is cited. AISI and Hugging Face are the two sources here with nothing to sell.
• One benchmark is not the threat landscape. AISI measured a purpose-built range under controlled conditions with classifiers reduced. It establishes a capability trend, not a rate of real-world use. The CrowdStrike and Anthropic figures bridge capability to adoption and they are the weaker half of the argument.
• The domain-span chart is our classification. It is labeled on the chart because it belongs in a conversation where the basis is visible, not in a citation.
• Everything in the CINQUE section is a mechanism claim, and mechanism claims get demonstrated. Persona baselining is what UEBA promised for over a decade and largely failed to deliver, and that history is a reasonable prior for any buyer to hold. The answer is not a statistic. It is watching the correlation run against your own tooling and your own agent identities inside an evaluation.

Notes About Stats

These are both in circulation right now, and neither survived a check against its own source.

CrowdStrike's 2026 release calls 29 minutes "65% faster than 2024," which does not square with its own 2025 report figure of 48 minutes. That arithmetic gives 39.6%. The chart above uses the 48-to-29 comparison instead, same source and same metric, and I have left the 65% figure alone.

Separately, CyberGym's best published result was 22% in the paper's March 2026 revision, while a third-party leaderboard shows 86.9% as of early September. If those measure the same thing, it is a more dramatic number than anything else in this post. If they don't, it is a scoring artifact. Until someone establishes which, I will not cite it.

Two smaller ones:

• The Klue figures trace only to a Cloud Security Alliance research note, a secondary aggregation, while every other incident here has a primary or vendor-primary source, so weight them accordingly.
• Hugging Face's nine published phase counts sum to 16,521 against a stated total of roughly 17,600 actions recovered, which is why the evasion ratio above is quoted against classified actions rather than the total.

Sources

1. UK AI Security Institute, "Measuring AI agents' progress on multi-step cyber attack scenarios," 16 Mar 2026, arXiv:2603.11214.
2. CrowdStrike Global Threat Report, 2026 edition (24 Feb 2026) and 2025 edition (27 Feb 2025).
3. Anthropic, "What we learned mapping a year's worth of AI-enabled cyber threats," 3 Jun 2026.
4. Microsoft Security Blog, "Defending SaaS-based applications against ShinyHunters OAuth abuse," 13 Jul 2026.
5. Tenet Security, "Agentjacking," 17 Jun 2026.
6. Sysdig, "JADEPUFFER: Agentic ransomware for automated database extortion," 1 Jul 2026.
7. Hugging Face, "Anatomy of a Frontier Lab Agent Intrusion," Jul 2026; OpenAI incident report, 21 Jul 2026.
8. SecurityWeek on UK AISI rogue-behavior findings, 5 Aug 2026.
9. Sygnia, "Fire Ant Evolves: From Hypervisors to Trusted Infrastructure," 27 Aug 2026.
10. ESET via The Hacker News, UAC-0099 GuardBreaker disclosure, 1 Sep 2026.
11. Cloud Security Alliance, "ShinyHunters' OAuth Pivot: A Year of SaaS Supply-Chain Breaches," 16 Jul 2026.
12. IBM, Think 2026 identity recap, 8 May 2026. OWASP Top 10 for Agentic Applications 2026. Loom Security product documentation, loomsecurity.io.